Colorado ADMT Act (SB 26-189)

Receipt evidence and the transition to Colorado's ADMT framework

Updated

Colorado SB 26-189 repeals and reenacts SB 24-205. Its automated decision-making technology (ADMT) deployer requirements apply to consequential decisions made on or after 1 January 2027. Asqav's colorado_ai report retains the SB 24-205 section mapping shown below. An assessment against the SB 26-189 ADMT requirements is not yet available.

Asqav signs submitted AI agent actions with ML-DSA, binds them to the deployer's policy artefact via policy_digest, and chains receipts so an auditor can reconstruct the period covered by an impact assessment without reading the underlying payload.

The receipt format is profiled in the IETF Internet-Draft draft-marques-asqav-compliance-receipts, which includes the retained SB 24-205 section mapping shown below. These references describe that report mapping, not the replacement ADMT obligations.

SB 24-205 report mapping

Section SB 24-205 requirement Asqav binding
Risk-management policy Implement a risk-management policy and programme for the High-Risk AI System. policy_digest resolves through the audit pack to the deployer's risk-management policy in force at action time. Risk-bearing actions carry the risk_class extension.
Impact assessment Complete an impact assessment annually and within 90 days of any intentional and substantial modification. Query type, policy_digest, and previousReceiptHash to identify the receipts in the assessment window, including any policy changes within that period.
Discrimination notice On determination of algorithmic discrimination, record the determination and the affected actions. Emit a protectmcp:lifecycle receipt naming the affected action_ref values and a reason code.

See the docs for the full mapping and the IETF draft for the binding text.

References